Contract analysis

I. Executive Summary This memorandum sets forth the findings and recommendations of Calderwood & Harkness LLP's Privacy & Data Security practice group with respect to the privacy and data security posture of Quillen Technologies, Inc. ("Quillen" or the "Company"), a Delaware C-corporation headquartered at 88 Garrison Street, Floor 4, Boston, Massachusetts 02116, in connection with Pinnacle Venture Fund II LP's ("Pinn

II. Company Background and Data Environment A. Business Description and the Mosaic Platform Quillen Technologies, Inc. develops and commercializes "Mosaic," an AI-driven portfolio analytics and risk-attribution platform designed for institutional investors. The Mosaic platform is offered on a Software-as-a-Service ("SaaS") subscription basis to institutional asset managers, pension consultants, endowments, and simila

III. Applicable Privacy Laws and Regulatory Framework A. California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA) The California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, "CCPA/CPRA"), imposes a broad range of obligations on covered businesses with respect to the collection, use, disclosure, and sale of personal information of California

IV. Review of Quillen's Privacy Policy Quillen maintains a publicly accessible privacy policy published at quillentech.io. The policy describes the categories of information collected by the Company, the purposes for which such information is processed, the Company's data sharing practices, and the rights available to individuals with respect to their personal information. We reviewed the policy in detail and set for

V. Review of Customer-Facing Data Processing Agreements (DPAs) We reviewed Quillen's template customer data processing agreement and three executed DPAs with institutional clients (client names redacted in the data room). The DPA is executed as an addendum to the Company's master subscription agreement and governs the data processing relationship between Quillen and its institutional clients with respect to the clien

VI. SOC 2 Compliance Status A. SOC 2 Type I Report Quillen completed a SOC 2 Type I audit in January 2026. The audit was performed by Pemberton & Associates CPAs LLP, with Diane Stratton, CPA serving as the engagement partner. The SOC 2 Type I report covers the design and implementation of Quillen's controls relevant to the American Institute of Certified Public Accountants ("AICPA") Trust Services Criteria for the c

VII. Data Breach History and Incident Response A. Data Breach History Quillen has represented, through Company counsel, that the Company has not experienced any data breaches, security incidents, or unauthorized access to customer or Company data at any time since its incorporation on July 12, 2023. This representation is consistent with the following additional information: (a) No breach notifications have been file

VIII. Information Security Policies and Practices A. Written Information Security Program (WISP) Quillen maintains an internal information security policy document that functions as its Written Information Security Program. The WISP covers the following areas: acceptable use of Company systems and resources; access control policies, including role-based access and the principle of least privilege; password management

IX. Open-Source and AI-Specific Considerations The Mosaic platform is described and marketed as an "AI-driven" portfolio analytics and risk-attribution tool. The platform employs machine learning models to analyze client portfolio data, perform risk decomposition, and generate performance attribution insights. Given the increasing regulatory and market scrutiny of artificial intelligence and machine learning in finan

X. Risk Assessment Summary The following is a summary of our risk assessment based on the findings described in the preceding sections of this memorandum. A. Low-Risk Findings

1. Institutional B2B Data Environment. The Company's data processing activities predominantly involve institutional portfolio-level data with limited exposure to high-volume consumer PII, which significantly reduces the Company's privacy risk profile.

2. No Data Breaches. No data breaches, security incidents, or unauthorized access events have occurred since the Company's incorporation on July 12, 2023. No breach notifications have been filed, and no related litigation, claims, or regulatory inquiries have been initiated or threatened.

3. SOC 2 Type I Completed. The Company completed a SOC 2 Type I audit in January 2026 with no material exceptions noted in the design of controls.

4. Technical Security Controls. The Company maintains encryption (AES-256 at rest, TLS 1.2+ in transit), multi-factor authentication, and role-based access controls, all of which meet or exceed industry standards for companies at this stage.

5. Limited Statutory Applicability. CCPA/CPRA and most state comprehensive privacy laws do not currently apply to the Company based on its revenue and data processing volumes. B. Moderate-Risk Findings

1. SOC 2 Type II Not Yet Completed. The SOC 2 Type II audit is in process and expected to be completed in Q3 2026. Until the Type II report is available, there is a gap between the point-in-time design assurance provided by the Type I report and the sustained operating effectiveness assurance that the Type II report will provide.

2. No Dedicated CISO or DPO. The Company does not currently have a dedicated Chief Information Security Officer or Data Protection Officer. CTO Julian Voss serves as the de facto security lead. As the Company scales, this arrangement creates risk related to the adequacy of security governance and the CTO's ability to dedicate sufficient attention to security matters alongside his other responsibilities.

3. Incident Response Plan Not Tested. The Company has not conducted tabletop exercises or incident response simulations to validate the effectiveness of its written incident response plan. Untested incident response procedures carry incremental risk of operational failure in the event of an actual security incident.

4. Privacy Policy Lacks AI/ML Disclosures. The Company's published privacy policy does not include disclosures specific to the use of artificial intelligence and machine learning in the processing of client data. Given the increasing regulatory and market expectation for transparency around AI data practices, this gap creates reputational and regulatory risk.

5. DPA Variation. Variation in notification timeframes (twenty-four hours versus seventy-two hours) and deletion periods (fifteen days versus thirty days) across executed customer DPAs creates operational complexity and increases the risk of non-compliance with the most restrictive applicable terms.

6. Informal Vendor Risk Management. The Company's vendor review process is functional but informal and not governed by a written vendor risk management program, which creates risk as the vendor ecosystem expands. C. Items Requiring Post-Closing Attention The following items should be addressed through post-closing obligations, covenants, or management undertakings:

1. Completion of SOC 2 Type II audit by end of Q3 2026.

2. Designation of a formal security lead or hire of a CISO within six (6) months of closing.

3. Conduct of the first incident response tabletop exercise within six (6) months of closing.

4. Update of the Company's privacy policy to include AI/ML-specific data use disclosures and anticipatory CCPA compliance provisions, within ninety (90) days of closing.

5. Implementation of a formal, documented vendor risk management program within ninety (90) days of closing.

6. Adoption of a standardized DPA template for new customer agreements, incorporating lessons learned from the current DPA review.

7. Preparation for CCPA/CPRA and other state privacy law compliance as the Company's revenue and data processing volumes scale, including the designation of a privacy contact and the development of consumer request response procedures.

XI. Recommendations for SPA Representations, Warranties, and Closing Conditions Based on the findings set forth in this memorandum, we recommend the following provisions be included in the Series A Stock Purchase Agreement, the Investors' Rights Agreement, and/or the Pinnacle Side Letter, as appropriate. A. Recommended Representations and Warranties (Company Side) We recommend that the Company make the following repr

1. Privacy Law Compliance. The Company has complied in all material respects with all applicable privacy and data security laws, rules, and regulations, including without limitation the Massachusetts Standards for the Protection of Personal Information of Residents of the Commonwealth (201 CMR 17.00), and the Company is not currently subject to the California Consumer Privacy Act or any other state comprehensive priv

2. Privacy Policy Compliance. The Company's published privacy policy accurately and completely describes the Company's data collection, use, sharing, and retention practices in all material respects, and the Company has complied with its published privacy policy in all material respects since its first publication.

3. No Breaches. The Company has not experienced any data breach, security incident, unauthorized access to, or unauthorized disclosure of personal information or customer data at any time since its incorporation on July 12, 2023, and the Company has not been required to provide any notification to any individual, governmental authority, or other entity relating to any such event.

4. DPA Compliance. The Company is in material compliance with all of its obligations under customer data processing agreements, master subscription agreements, and other contracts relating to the processing, security, or privacy of customer data or personal information.

5. No Regulatory Proceedings. No proceedings, investigations, inquiries, audits, or enforcement actions by any governmental authority relating to the Company's data privacy or data security practices have been initiated, are pending, or have been threatened against the Company, and no circumstances exist that would reasonably be expected to give rise to any such proceedings.

6. Written Information Security Program. The Company maintains a written information security program reasonably designed to protect the confidentiality, integrity, and availability of customer data and personal information, consistent with industry standards and applicable legal requirements.

7. AI/ML Data Use. The Company does not use customer data for cross-client model training, product development, or other secondary purposes without the explicit prior consent of the affected customer, and the Company has not derived or generated any machine learning models, datasets, or analytical outputs from customer data that are used for the benefit of parties other than the contributing customer without such cus

8. SOC 2 Status. The Company has completed a SOC 2 Type I audit performed by Pemberton & Associates CPAs LLP, with no material exceptions noted, and is currently engaged in a SOC 2 Type II audit expected to be compl